Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 04:16
General
- Target 1fa44041_.exe
- Size 22.5MB
- Sample260701-ev43lsd19k
- SHA256 1da6f290459efcf121d9a84d43bbe052488e615ca49d91ed736cddbbac1657a3
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fa44041_.exe"C:\Users\Admin\AppData\Local\Temp\1fa44041_.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\FileManager\FileManager.exe"C:\ProgramData\FileManager\FileManager.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 5003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3940 -ip 39401⤵
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\System Volume Information\Heat" && start "" "C:\ProgramData\FileManager\FileManager.exe""1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Cache.pmt
FileManager.exe
MAsMlX32.dll
memory/252-124-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-113-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-126-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-116-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-121-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-122-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-123-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-103-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-115-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-125-0x0000000002660000-0x0000000002687000-memory.dmp
memory/252-101-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-112-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-100-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-102-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-106-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-104-0x0000000010000000-0x0000000010281000-memory.dmp
memory/252-105-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1492-41-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/1492-42-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/1492-29-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/1492-32-0x000001EC6D630000-0x000001EC6D9D7000-memory.dmp
memory/1492-39-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/1492-40-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/1492-38-0x0000000180000000-0x00000001803AB000-memory.dmp
memory/3940-76-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-43-0x0000000001220000-0x000000000149B000-memory.dmp
memory/3940-53-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-56-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-75-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-74-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-73-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-78-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-77-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-68-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-67-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-81-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-79-0x0000000004310000-0x0000000004337000-memory.dmp
memory/3940-52-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-44-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-54-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-65-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-55-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-57-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-60-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-61-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3940-58-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4960-28-0x0000000000400000-0x0000000000637000-memory.dmp
memory/4960-26-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-27-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-25-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-24-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-23-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-22-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-14-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-127-0x0000000180000000-0x000000018090A000-memory.dmp
memory/4960-128-0x0000000000400000-0x0000000000637000-memory.dmp